Since this weakness does not typically appear frequently within a single software package, manual white box techniques may be able to provide sufficient code coverage and reduction of false positives if all potentially-vulnerable operations can be assessed within limited time constraints.
CWE-807 Base Incompleto
Reliance on Untrusted Inputs in a Security Decision
This vulnerability occurs when an application's security check depends on user-controlled data that can be manipulated to bypass protection mechanisms, such as authentication or authorization gates.
Definición
What is CWE-807?
This vulnerability occurs when an application's security check depends on user-controlled data that can be manipulated to bypass protection mechanisms, such as authentication or authorization gates.
Developers often mistakenly trust inputs like cookies, hidden form fields, or environment variables, assuming they can't be altered by users. However, attackers can modify these values using proxy tools, crafted requests, or client-side tampering. When your code uses these tainted inputs to make critical security decisions—like checking if a user is an admin—the entire security model can be circumvented if the input isn't properly validated and secured.
Any data originating from outside your trusted boundary should be considered potentially malicious. Without strong integrity checks, encryption, or server-side validation, you cannot rely on it for security decisions. Managing this at scale is difficult; an ASPM like Plexicus can help you track and remediate these trust-boundary flaws across your entire application stack, using AI to prioritize risks and suggest specific fixes.
Impacto en el mundo real
Real-world CVEs caused by CWE-807
-
Attacker can bypass authentication by setting a cookie to a specific value.
-
Attacker can bypass authentication and gain admin privileges by setting an "admin" cookie to 1.
-
Content management system allows admin privileges by setting a "login" cookie to "OK."
-
e-dating application allows admin privileges by setting the admin cookie to 1.
-
Web-based email list manager allows attackers to gain admin privileges by setting a login cookie to "admin."
Cómo lo explotan los atacantes
Ruta del atacante paso a paso
- 1
The following code excerpt reads a value from a browser cookie to determine the role of the user.
- 2
The following code could be for a medical records application. It performs authentication by checking if a cookie has been set.
- 3
The programmer expects that the AuthenticateUser() check will always be applied, and the "authenticated" cookie will only be set when authentication succeeds. The programmer even diligently specifies a 2-hour expiration for the cookie.
- 4
However, the attacker can set the "authenticated" cookie to a non-zero value such as 1. As a result, the $auth variable is 1, and the AuthenticateUser() check is not even performed. The attacker has bypassed the authentication.
- 5
In the following example, an authentication flag is read from a browser cookie, thus allowing for external control of user state data.
Ejemplo de código vulnerable
Vulnerable Java
The following code excerpt reads a value from a browser cookie to determine the role of the user.
Cookie[] cookies = request.getCookies();
for (int i =0; i< cookies.length; i++) {
Cookie c = cookies[i];
if (c.getName().equals("role")) {
userRole = c.getValue();
}
} Ejemplo de código seguro
Secure pseudo
// Validate, sanitize, or use a safe API before reaching the sink.
function handleRequest(input) {
const safe = validateAndEscape(input);
return executeWithGuards(safe);
} What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.
Lista de prevención
How to prevent CWE-807
- Architecture and Design Store state information and sensitive data on the server side only. Ensure that the system definitively and unambiguously keeps track of its own state and user state and has rules defined for legitimate state transitions. Do not allow any application user to affect state directly in any way other than through legitimate actions leading to state transitions. If information must be stored on the client, do not do so without encryption and integrity checking, or otherwise having a mechanism on the server side to catch tampering. Use a message authentication code (MAC) algorithm, such as Hash Message Authentication Code (HMAC) [REF-529]. Apply this against the state or sensitive data that has to be exposed, which can guarantee the integrity of the data - i.e., that the data has not been modified. Ensure that a strong hash function is used (CWE-328).
- Architecture and Design Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. With a stateless protocol such as HTTP, use a framework that maintains the state for you. Examples include ASP.NET View State [REF-756] and the OWASP ESAPI Session Management feature [REF-45]. Be careful of language features that provide state support, since these might be provided as a convenience to the programmer and may not be considering security.
- Architecture and Design For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
- Operation / Implementation When using PHP, configure the application so that it does not use register_globals. During implementation, develop the application so that it does not rely on this feature, but be wary of implementing a register_globals emulation that is subject to weaknesses such as CWE-95, CWE-621, and similar issues.
- Architecture and Design / Implementation Understand all the potential areas where untrusted inputs can enter your software: parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, filenames, databases, and any external systems that provide data to the application. Remember that such inputs may be obtained indirectly through API calls. Identify all inputs that are used for security decisions and determine if you can modify the design so that you do not have to rely on submitted inputs at all. For example, you may be able to keep critical information about the user's session on the server side instead of recording it within external data.
Señales de detección
How to detect CWE-807
According to SOAR [REF-1479], the following detection techniques may be useful: ``` Cost effective for partial coverage: ``` Bytecode Weakness Analysis - including disassembler + source code weakness analysis Binary Weakness Analysis - including disassembler + source code weakness analysis
According to SOAR [REF-1479], the following detection techniques may be useful: ``` Cost effective for partial coverage: ``` Binary / Bytecode disassembler - then use manual analysis for vulnerabilities & anomalies
According to SOAR [REF-1479], the following detection techniques may be useful: ``` Cost effective for partial coverage: ``` Web Application Scanner Web Services Scanner Database Scanners
According to SOAR [REF-1479], the following detection techniques may be useful: ``` Cost effective for partial coverage: ``` Fuzz Tester Framework-based Fuzzer Monitored Virtual Environment - run potentially malicious code in sandbox / wrapper / virtual machine, see if it does anything suspicious
According to SOAR [REF-1479], the following detection techniques may be useful: ``` Highly cost effective: ``` Manual Source Code Review (not inspections)
Plexicus detecta automáticamente CWE-807 y abre un PR de corrección en menos de 60 segundos.
Codex Remedium escanea cada commit, identifica esta debilidad concreta y entrega un pull request listo para revisión con el parche. Sin tickets. Sin traspasos.
Preguntas frecuentes ¿Qué es CWE-807?
¿Qué gravedad tiene CWE-807?
¿Qué lenguajes o plataformas se ven afectados por CWE-807?
¿Cómo puedo prevenir CWE-807?
¿Cómo detecta y corrige Plexicus CWE-807?
¿Dónde puedo aprender más sobre CWE-807?
Frequently asked questions
¿Qué es CWE-807?
This vulnerability occurs when an application's security check depends on user-controlled data that can be manipulated to bypass protection mechanisms, such as authentication or authorization gates.
¿Qué gravedad tiene CWE-807?
MITRE califica la probabilidad de explotación como Alta — esta debilidad se explota activamente en la práctica y debe priorizarse para su remediación.
¿Qué lenguajes o plataformas se ven afectados por CWE-807?
MITRE no ha especificado plataformas afectadas para esta CWE — puede aplicar a la mayoría de los stacks de aplicaciones.
¿Cómo puedo prevenir CWE-807?
Store state information and sensitive data on the server side only. Ensure that the system definitively and unambiguously keeps track of its own state and user state and has rules defined for legitimate state transitions. Do not allow any application user to affect state directly in any way other than through legitimate actions leading to state transitions. If information must be stored on the client, do not do so without encryption and integrity checking, or otherwise having a mechanism on…
¿Cómo detecta y corrige Plexicus CWE-807?
El motor SAST de Plexicus detecta la firma de flujo de datos para CWE-807 en cada commit. Cuando hay coincidencia, nuestro agente Codex Remedium abre un PR de corrección con el código corregido, las pruebas y un resumen de una línea para el revisor.
¿Dónde puedo aprender más sobre CWE-807?
MITRE publica la definición canónica en https://cwe.mitre.org/data/definitions/807.html. También puedes consultar la documentación de OWASP y NIST para guías relacionadas.
Debilidades relacionadas
Weaknesses related to CWE-807
CWE-693 Padre
Protection Mechanism Failure
This weakness occurs when software either lacks a necessary security control, implements one that is too weak, or fails to activate an…
CWE-1039 Hermano
Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism
This vulnerability occurs when a system uses automated AI or machine learning to classify complex inputs like images, audio, or text, but…
CWE-1248 Hermano
Semiconductor Defects in Hardware Logic with Security-Sensitive Implications
A security-critical hardware component contains physical flaws in its semiconductor material, which can cause it to malfunction and…
CWE-1253 Hermano
Incorrect Selection of Fuse Values
This vulnerability occurs when a hardware security fuse is incorrectly programmed to represent a 'secure' state as logic 0 (unblown). An…
CWE-1269 Hermano
Product Released in Non-Release Configuration
This vulnerability occurs when a product ships to customers while still configured with its pre-production or manufacturing settings,…
CWE-1278 Hermano
Missing Protection Against Hardware Reverse Engineering Using Integrated Circuit (IC) Imaging Techniques
This vulnerability occurs when hardware lacks safeguards against physical inspection, allowing attackers to extract sensitive data by…
CWE-1291 Hermano
Public Key Re-Use for Signing both Debug and Production Code
This vulnerability occurs when the same cryptographic key is used to sign both development/debug software builds and final production…
CWE-1318 Hermano
Missing Support for Security Features in On-chip Fabrics or Buses
This vulnerability occurs when the communication channels (fabrics or buses) within a chip lack built-in or enabled security features,…
CWE-1319 Hermano
Improper Protection against Electromagnetic Fault Injection (EM-FI)
This vulnerability occurs when a hardware device lacks sufficient shielding against electromagnetic interference, allowing attackers to…
Recursos
Further reading
- MITRE — CWE-807 oficial https://cwe.mitre.org/data/definitions/807.html
- Top 25 Series - Rank 6 - Reliance on Untrusted Inputs in a Security Decision https://www.sans.org/blog/top-25-series-rank-6-reliance-on-untrusted-inputs-in-a-security-decision/
- HMAC https://en.wikipedia.org/wiki/HMAC
- Understanding ASP.NET View State https://learn.microsoft.com/en-us/previous-versions/dotnet/articles/ms972976(v=msdn.10)?redirectedfrom=MSDN
- OWASP Enterprise Security API (ESAPI) Project https://owasp.org/www-project-enterprise-security-api/
- State-of-the-Art Resources (SOAR) for Software Vulnerability Detection, Test, and Evaluation https://www.ida.org/-/media/feature/publications/s/st/stateoftheart-resources-soar-for-software-vulnerability-detection-test-and-evaluation/p-5061.ashx
Listo cuando tú lo estés
Deja de pagar por desarrollador.
Empieza a cerrar el bucle.
Plexicus es el ASPM nativo de IA que escanea, filtra, corrige, pentestea y explica — de forma autónoma. Desarrolladores ilimitados, repos ilimitados, acciones de IA de uso justo. Nivel gratuito real, €269/mo anual cuando estés listo.